oss-sec mailing list archives
CVE-2017-16611 libXfont Open files with O_NOFOLLOW
From: Matthieu Herrb <matthieu.herrb () laas fr>
Date: Tue, 28 Nov 2017 15:55:24 +0100
Hi, X.Org has just release libXfont 1.5.4 and libXfont2 2.0.3 which contain the following security fix: Author: Michal Srb <msrb () suse com> AuthorDate: Thu Oct 26 09:48:13 2017 +0200 Commit: Matthieu Herrb <matthieu () herrb eu> CommitDate: Sat Nov 25 11:46:50 2017 +0100 Open files with O_NOFOLLOW. (CVE-2017-16611) A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue with special files such as /dev/watchdog. https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2 https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2 -- Matthieu Herrb
Attachment:
signature.asc
Description:
Current thread:
- CVE-2017-16611 libXfont Open files with O_NOFOLLOW Matthieu Herrb (Nov 28)